FBI Disrupts Laptop Farms Behind North Korean Remote Hires

The FBI disrupted several U.S. laptop farms used by FAMOUS CHOLLIMA, a North Korea-linked remote-worker operation, in late September, according to CrowdStrike’s account of its work with the bureau. Fraudulently hired workers used employer-issued laptops at those farms to reach American companies while hiding where they actually worked. CrowdStrike says it identified dozens of victim organizations across the disrupted clusters, including aerospace, energy, finance, healthcare and defense engineering firms.

The surprising part for an employer is how ordinary a hire can look from the network: a company laptop connects from a U.S. home while someone elsewhere operates it remotely. CrowdStrike participated in the disruption and is assessing an operation it tracks; its account says farm closures are likely to have limited, local effects while the wider activity continues. For defenders, the useful starting point is the hiring and shipping trail that put the laptop there.

A home address hosts the laptop

CrowdStrike says FAMOUS CHOLLIMA operatives used stolen or fraudulent identities to obtain remote jobs, then redirected company hardware to U.S. facilitators. Its OverWatch team observed false police reports claiming a laptop was stolen, used to trigger a replacement shipment to a farm address. Other workers said they had moved just before delivery. Some came through IT staffing firms, which could send an end client’s device onward without knowing the destination was a farm.

At the U.S. address, a facilitator set up hardware and software for remote access to the employer’s machine. The worker could then use a real company device to maintain access while drawing wages under a false identity. The address and domestic connection make a location-based screen less useful: they locate the laptop, while the person controlling it can be elsewhere.

The FBI’s 2024 IC3 advisory describes U.S.-based facilitators receiving company laptops, enabling remote desktop connections, sometimes reshipping devices overseas, and arranging financial or job-site accounts. It also warns that outsourced IT hiring puts the client farther from the identity check. That advisory describes the broader scheme; CrowdStrike supplies the observations from this disruption.

Reused hardware links separate hires

CrowdStrike reports that, since May 2026, FAMOUS CHOLLIMA has spoofed device hashes, including making a video capture card appear to be a webcam. OverWatch saw the same disguised device across separate victim organizations. It also found laptop-farm network infrastructure sharing identifiers across simultaneous fake personas. Treat a familiar-looking webcam and a U.S. source address as device observations; verify the worker separately.

CrowdStrike also observed attempts to hide remote monitoring and management software. For an employer, combine endpoint software inventory and remote-connection telemetry with recruitment records, device shipment history and the approved address. A shipping change shortly before onboarding paired with unapproved remote-control software warrants investigation; verify the worker before attributing the activity. A spoofed hardware identifier can travel across employers, so investigators may need their provider’s cross-customer intelligence to recognize the reuse CrowdStrike saw.

Local closures leave other routes

CrowdStrike expects the operation to continue after the disruption of several farms. Its own description says a takedown has “limited impact on FAMOUS CHOLLIMA,” concentrated around where it happens. The victim organizations CrowdStrike identified span the disrupted clusters in the U.S.; companies outside those clusters should still examine their own remote-hire records.

A farm gives a false hire a place to receive hardware, run a U.S. connection and arrange a local financial footprint. CrowdStrike says removing that footprint forces operators to rebuild and relocate, while the employment fraud can continue elsewhere. The FBI’s earlier advisory describes how a facilitator can even attend interviews on a worker’s behalf. Screening a shipped device once, then trusting its address forever, leaves the operator free to change how the machine is reached after onboarding. Continue worker verification during employment and tie the approved person’s record to the specific device and remote-access policy.

Reconcile people, devices and access

Start with remote hires whose company laptops changed delivery address after approval, including placements arranged by staffing firms. Compare the verified worker identity, interview and shipping records with the receiving address; ask the staffing partner to flag changes in addresses and payment platforms. The FBI recommends identity checks at hiring, onboarding and during employment, along with reliable follow-up when verification returns an error. Require an independently verified address change before releasing or replacing a device.

For those devices, review the endpoint’s installed remote desktop and RMM software against approved tools, then examine remote-connection activity and the employee account’s network activity. The FBI recommends capturing suspected-device activity and reporting suspected cases to IC3. If the hiring record, shipping destination and endpoint activity point to an unauthorized operator, restrict that worker’s access under the organization’s incident process and preserve the evidence before reissuing hardware or credentials.

A clean geolocation check says where a laptop connected, not who controlled it. Verify the next onboarding decision against the approved address and identity record, then check that the issued endpoint has only authorized remote-access software and that its observed connections match that policy. Keep these local identity and endpoint checks running after a farm closure elsewhere.